You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
ValidateSchema::evaluate is not thread safe. It is setting member variables of ValidateSchema, in this case m_parserCtx when this variable is used only once in the function. This causes a use-after-free error in the following scenario:
T2 runs [freeXmlSchemaParser](https://github.com/SpiderLabs/ModSecurity/blob/4127c1bf52d2b30a5c2c3e641b8085fd9a720f43/src/operators/validate_schema.cc#L130), causing a use-after-free on m_parserCtx
Expected behavior/fix m_parserCtx is no longer needed as a member, so we use a local variable instead.
The text was updated successfully, but these errors were encountered:
It hadn't gotten moved to v3/master so far -- partly simply due to low priority since this operator does not appear to be widely used. I will proceed to do so, however, just to clean it up if nothing else.
Although this item is, in essence, a duplicate, I'll leave it open for now as reminder since the original item was closed with the merge to the other branch.
Describe the bug
ValidateSchema::evaluate is not thread safe. It is setting member variables of
ValidateSchema
, in this casem_parserCtx
when this variable is used only once in the function. This causes a use-after-free error in the following scenario:[xmlSchemaNewParserCtxt](https://github.com/SpiderLabs/ModSecurity/blob/4127c1bf52d2b30a5c2c3e641b8085fd9a720f43/src/operators/validate_schema.cc#L46)
[xmlSchemaNewParserCtxt](https://github.com/SpiderLabs/ModSecurity/blob/4127c1bf52d2b30a5c2c3e641b8085fd9a720f43/src/operators/validate_schema.cc#L46)
[freeXmlSchemaParser](https://github.com/SpiderLabs/ModSecurity/blob/4127c1bf52d2b30a5c2c3e641b8085fd9a720f43/src/operators/validate_schema.cc#L130)
[freeXmlSchemaParser](https://github.com/SpiderLabs/ModSecurity/blob/4127c1bf52d2b30a5c2c3e641b8085fd9a720f43/src/operators/validate_schema.cc#L130)
, causing a use-after-free on m_parserCtxExpected behavior/fix
m_parserCtx
is no longer needed as a member, so we use a local variable instead.The text was updated successfully, but these errors were encountered: